---
id: 5055
title: "Splitting the email atom: exploiting parsers to bypass access controls"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/splitting-the-email-atom"
published_at: "2025-06-27 13:49"
tags: ["rce", "email-security", "unicode", "punycode", "parser-discrepancies", "access-control-bypass"]
phying_url: "https://phying.com/item/5055"
lang: en
---

# Splitting the email atom: exploiting parsers to bypass access controls

## Summary

Email parser discrepancies — quoted values, Unicode overflows, encoded-word, malformed Punycode — become access control bypasses and RCE, with cases against GitHub, Zendesk, GitLab and Joomla.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2025-06-27 13:49
- **Original:** https://portswigger.net/research/splitting-the-email-atom
- **Phying News:** https://phying.com/item/5055